All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: frank.rowand@sony.com
Cc: devicetree@vger.kernel.org
Subject: [bug report] of: overlay: rework overlay apply and remove kfree()s
Date: Wed, 27 Apr 2022 10:44:10 +0300	[thread overview]
Message-ID: <Ymj0Sg7ubvNeXgyG@kili> (raw)

Hello Frank Rowand,

The patch 067c098766c6: "of: overlay: rework overlay apply and remove
kfree()s" from Apr 20, 2022, leads to the following Smatch static
checker warning:

	drivers/of/overlay.c:180 overlay_notify()
	error: buffer overflow 'of_overlay_action_name' 4 <= 4

drivers/of/overlay.c
   155  static char *of_overlay_action_name[] = {

We need to add a "init" string at the start of this array.

   156          "pre-apply",
   157          "post-apply",
   158          "pre-remove",
   159          "post-remove",
   160  };
   161  
    162 static int overlay_notify(struct overlay_changeset *ovcs,
    163                 enum of_overlay_notify_action action)
    164 {
    165         struct of_overlay_notify_data nd;
    166         int i, ret;
    167 
    168         ovcs->notify_state = action;
    169 
    170         for (i = 0; i < ovcs->count; i++) {
    171                 struct fragment *fragment = &ovcs->fragments[i];
    172 
    173                 nd.target = fragment->target;
    174                 nd.overlay = fragment->overlay;
    175 
    176                 ret = blocking_notifier_call_chain(&overlay_notify_chain,
    177                                                    action, &nd);
    178                 if (notifier_to_errno(ret)) {
    179                         ret = notifier_to_errno(ret);
--> 180                         pr_err("overlay changeset %s notifier error %d, target: %pOF\n",
    181                                of_overlay_action_name[action], ret, nd.target);
                                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
These are all shifted and so post remove is out of bounds.

    182                         return ret;
    183                 }
    184         }
    185 
    186         return 0;
    187 }

regards,
dan carpenter

             reply	other threads:[~2022-04-27  7:44 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-27  7:44 Dan Carpenter [this message]
2022-04-28 18:18 ` [bug report] of: overlay: rework overlay apply and remove kfree()s Frank Rowand

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Ymj0Sg7ubvNeXgyG@kili \
    --to=dan.carpenter@oracle.com \
    --cc=devicetree@vger.kernel.org \
    --cc=frank.rowand@sony.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.